Patents by Inventor Simon P. Johnson
Simon P. Johnson has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).
-
Patent number: 9448950Abstract: Systems and methods for secure delivery of output surface bitmaps to a display engine. An example processing system comprises: an architecturally protected memory; and a plurality of processing devices communicatively coupled to the architecturally protected memory, each processing device comprising a first processing logic to implement an architecturally-protected execution environment by performing at least one of: executing instructions residing in the architecturally protected memory, or preventing an unauthorized access to the architecturally protected memory; wherein each processing device further comprises a second processing logic to establish a secure communication channel with a second processing device of the processing system, employ the secure communication channel to synchronize a platform identity key representing the processing system, and transmit a platform manifest comprising the platform identity key to a certification system.Type: GrantFiled: December 24, 2013Date of Patent: September 20, 2016Assignee: Intel CorporationInventors: Vincent R. Scarlata, Simon P. Johnson, Vladimir Beker, Jesse Walker, Carlos V. Rozas, Amy L. Santoni, Ittai Anati, Raghunandan Makaram, Francis X. McKeen, Uday R. Savagaonkar
-
Publication number: 20160255097Abstract: In one embodiment, a method includes determining a location of a system responsive to location information received from at least one of a location sensor and a wireless device of the system, associating the location with a key present in the system to generate an authenticated location of the system, and determining whether the authenticated location is within a geofence boundary indicated in a location portion of a launch control policy (LCP) that provides a geographic-specific policy. Other embodiments are described and claimed.Type: ApplicationFiled: May 12, 2016Publication date: September 1, 2016Inventors: Ned M. Smith, Simon P. Johnson, Steve Orrin, Willard M. Wiseman
-
Patent number: 9430384Abstract: Instructions and logic provide advanced paging capabilities for secure enclave page caches. Embodiments include multiple hardware threads or processing cores, a cache to store secure data for a shared page address allocated to a secure enclave accessible by the hardware threads. A decode stage decodes a first instruction specifying said shared page address as an operand, and execution units mark an entry corresponding to an enclave page cache mapping for the shared page address to block creation of a new translation for either of said first or second hardware threads to access the shared page. A second instruction is decoded for execution, the second instruction specifying said secure enclave as an operand, and execution units record hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave, and decrement the recorded number of hardware threads when any of the hardware threads exits the secure enclave.Type: GrantFiled: March 31, 2013Date of Patent: August 30, 2016Assignee: Intel CorporationInventors: Carlos V Rozas, Ilya Alexandrovich, Ittai Anati, Alex Berenzon, Michael A Goldsmith, Barry E Huntley, Anton Ivanov, Simon P Johnson, Rebekah M. Leslie-Hurd, Francis X. McKeen, Gilbert Neiger, Rinat Rappoport, Scott Dion Rodgers, Uday R. Savagaonkar, Vincent R. Scarlata, Vedvyas Shanbhogue, Wesley H Smith, William Colin Wood
-
Publication number: 20160202976Abstract: Embodiments of an invention for memory management in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction and a second instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes allocating a page in an enclave page cache to a secure enclave. The execution unit is also to execute the second instruction, wherein execution of the second instruction includes confirming the allocation of the page.Type: ApplicationFiled: March 18, 2016Publication date: July 14, 2016Applicant: Intel CorporationInventors: Rebekah Leslie-Hurd, Carlos V. Rozas, Vincent R. Scarlata, Simon P. Johnson, Uday R. Savagaonkar, Barry E. Huntley, Vedvyas Shanbhogue, Ittai Anati, Francis X. Mckeen, Michael A. Goldsmith, Ilya Alexandrovich, Alex Berenzon, Wesley H. Smith, Gilbert Neiger
-
Publication number: 20160203340Abstract: An apparatus and method for securely suspending and resuming the state of a processor. For example, one embodiment of a method comprises: generating a data structure including at least the monotonic counter value; generating a message authentication code (MAC) over the data structure using a first key; securely providing the data structure and the MAC to a module executed on the processor; the module verifying the MAC, comparing the monotonic counter value with a counter value stored during a previous suspend operation and, if the counter values match, then loading processor state required for the resume operation to complete. Another embodiment of a method comprises: generating a first key by a processor; securely sharing the first key with an off-processor component; and using the first key to generate a pairing ID usable to identify a pairing between the processor and the off-processor component.Type: ApplicationFiled: March 24, 2016Publication date: July 14, 2016Inventors: VINCENT R. SCARLATA, SIMON P. JOHNSON, CARLOS V. ROZAS, FRANCIS X. MCKEEN, ITTAI ANATII, ILYA ALEXANDROVICH, REBEKAH M. LESLIE-HURD
-
Patent number: 9367688Abstract: In one embodiment, a method includes determining a location of a system responsive to location information received from at least one of a location sensor and a wireless device of the system, associating the location with a key present in the system to generate an authenticated location of the system, and determining whether the authenticated location is within a geofence boundary indicated in a location portion of a launch control policy (LCP) that provides a geographic-specific policy. Other embodiments are described and claimed.Type: GrantFiled: June 22, 2012Date of Patent: June 14, 2016Assignee: Intel CorporationInventors: Ned M. Smith, Simon P. Johnson, Steve Orrin, Willard M. Wiseman
-
Publication number: 20160134627Abstract: The present application is directed to establishing ownership of a secure workspace (SW). A client device may provide a SW data structure (SWDS) to a SW configurator. A SWDS may comprise a hash of an original SW and a public key, and may be signed by a private key corresponding to the public key. The SW configurator may cause an execution container (EC) to be generated including a SW initiated using the SWDS. The client device may claim SW ownership using a request (signed by the private key) transmitted along with a copy of the public key. SW ownership may be determined by an ownership determination module that verifies the signature of the request using the public key received with the request, determines a hash of the received public key and compares the hash of the received public key to a hash of the public key in the SWDS.Type: ApplicationFiled: November 6, 2014Publication date: May 12, 2016Applicant: Intel CorporationInventors: SIMON P. JOHNSON, ASHER M. ALTMAN, ABHISHEK DAS, VINCENT R. SCARLATA
-
Patent number: 9323686Abstract: Embodiments of an invention for paging in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes evicting a first page from an enclave page cache.Type: GrantFiled: December 28, 2012Date of Patent: April 26, 2016Assignee: Intel CorporationInventors: Francis X. Mckeen, Michael A. Goldsmith, Barry E. Huntley, Simon P. Johnson, Rebekah Leslie, Carlos V. Rozas, Uday R. Savagaonkar, Vincent R. Scarlata, Vedvyas Shanbhogue, Wesley H. Smith, Ittai Anati, Ilya Alexandrovich, Alex Berenzon, Gilbert Neiger
-
Publication number: 20160042184Abstract: Embodiments of an invention for logging in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction having an associated enclave page cache address. The execution unit is to execute the instruction without causing a virtual machine exit, wherein execution of the instruction includes logging the instruction and the associated enclave page cache address.Type: ApplicationFiled: October 21, 2015Publication date: February 11, 2016Applicant: Intel CorporationInventors: Francis X. Mckeen, Michael A. Goldsmith, Barrey E. Huntley, Simon P. Johnson, Rebekah M. Leslie-Hurd, Carlos V. Rozas, Uday R. Savagaonkar, Vincent R. Scarlata, Vedvyas Shanbhogue, Wesley H. Smith, Gilbert Neiger
-
Patent number: 9189411Abstract: Embodiments of an invention for logging in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction having an associated enclave page cache address. The execution unit is to execute the instruction without causing a virtual machine exit, wherein execution of the instruction includes logging the instruction and the associated enclave page cache address.Type: GrantFiled: December 28, 2012Date of Patent: November 17, 2015Assignee: Intel CorporationInventors: Francis X. Mckeen, Michael A. Goldsmith, Barrey E. Huntley, Simon P. Johnson, Rebekah Leslie, Carlos V. Rozas, Uday R. Savagaonkar, Vincent R. Scarlata, Vedvyas Shanbhogue, Wesley H. Smith
-
Patent number: 9087200Abstract: A technique to enable secure application and data integrity within a computer system. In one embodiment, one or more secure enclaves are established in which an application and data may be stored and executed.Type: GrantFiled: June 19, 2012Date of Patent: July 21, 2015Assignee: Intel CorporationInventors: Francis X. McKeen, Carlos V. Rozas, Uday R. Savagaonkar, Simon P. Johnson, Vincent Scarlata, Michael A. Goldsmith, Ernie Brickell, Jiang Tao Li, Howard C. Herbert, Prashant Dewan, Stephen J. Tolopka, Gilbert Neiger, David Durham, Gary Graunke, Bernard Lint, Don A. Van Dyke, Joseph Cihula, Stalinselvaraj Jeyasingh, Stephen R. Van Doren, Dion Rodgers, John Garney, Asher Altman
-
Publication number: 20150186680Abstract: An apparatus and method are described for implementing a trusted dynamic launch and trusted platform module (TPM) using a secure enclave. For example, a computer-implemented method according to one embodiment of the invention comprises: initializing a secure enclave in response to a first command, the secure enclave comprising a trusted software execution environment which prevents software executing outside the enclave from having access to software and data inside the enclave; and executing a trusted platform module (TPM) from within the secure enclave, the trusted platform module securely reading data from a set of platform control registers (PCR) in a processor or chipset component into a memory region allocated to the secure enclave.Type: ApplicationFiled: February 27, 2015Publication date: July 2, 2015Inventors: Simon P. Johnson, Vincent R. Scarlata, Willard M. Wiseman
-
Publication number: 20150178226Abstract: Systems and methods for secure delivery of output surface bitmaps to a display engine. An example processing system comprises: an architecturally protected memory; and a plurality of processing devices communicatively coupled to the architecturally protected memory, each processing device comprising a first processing logic to implement an architecturally-protected execution environment by performing at least one of: executing instructions residing in the architecturally protected memory, or preventing an unauthorized access to the architecturally protected memory; wherein each processing device further comprises a second processing logic to establish a secure communication channel with a second processing device of the processing system, employ the secure communication channel to synchronize a platform identity key representing the processing system, and transmit a platform manifest comprising the platform identity key to a certification system.Type: ApplicationFiled: December 24, 2013Publication date: June 25, 2015Inventors: Vincent R. Scarlata, Simon P. Johnson, Vladimir Beker, Jesse Walker, Carlos V. Rozas, Amy L. Santoni, Ittai Anati, Raghunandan Makaram, Francis X. McKeen, Uday R. Savagaonkar
-
Patent number: 9059855Abstract: An apparatus and method are described for implementing a trusted dynamic launch and trusted platform module (TPM) using a secure enclave. For example, a computer-implemented method according to one embodiment of the invention comprises: initializing a secure enclave in response to a first command, the secure enclave comprising a trusted software execution environment which prevents software executing outside the enclave from having access to software and data inside the enclave; and executing a trusted platform module (TPM) from within the secure enclave, the trusted platform module securely reading data from a set of platform control registers (PCR) in a processor or chipset component into a memory region allocated to the secure enclave.Type: GrantFiled: March 15, 2013Date of Patent: June 16, 2015Assignee: Intel CorporationInventors: Simon P. Johnson, Vincent R. Scarlata, Willard M. Wiseman
-
Patent number: 9043604Abstract: Keying materials used for providing security in a platform are securely provisioned both online and offline to devices in a remote platform. The secure provisioning of the keying materials is based on a revision of firmware installed in the platform.Type: GrantFiled: September 5, 2013Date of Patent: May 26, 2015Assignee: Intel CorporationInventors: Ernest F. Brickell, Shay Gueron, Jiangtao Li, Carlos V. Rozas, Daniel Nemiroff, Vincent R. Scarlata, Uday R. Savagaonkar, Simon P. Johnson
-
Publication number: 20150089173Abstract: Secure memory repartitioning technologies are described. A processor includes a processor core and a memory controller coupled between the processor core and main memory. The main memory includes a memory range including a section of convertible pages are convertible to secure pages or non-secure pages. The processor core, in response to a page conversion instruction, is to determine from the instruction a convertible page in the memory range to be converted and convert the convertible page to be at least one of a secure page or a non-secure page. The memory range may also include a hardware reserved section are convertible in response to a section conversion instruction.Type: ApplicationFiled: September 24, 2013Publication date: March 26, 2015Inventors: Siddhartha Chhabra, Uday R. Savagaonkar, Michael A. Goldsmith, Simon P. Johnson, Rebekah M. Leslie-Hurd, Francis X. McKeen, Gilbert Neiger, Raghunandan Makaram, Carlos V. Rozas, Amy L. Santoni, Vincent R. Scarlata, Vedvyas Shanbhogue, Wesley H. Smith, Ittai Anati, Ilya Alexandrovich
-
Patent number: 8972746Abstract: A technique to enable secure application and data integrity within a computer system. In one embodiment, one or more secure enclaves are established in which an application and data may be stored and executed.Type: GrantFiled: December 17, 2010Date of Patent: March 3, 2015Assignee: Intel CorporationInventors: Simon P. Johnson, Uday R. Savagaonkar, Vincent R. Scarlata, Francis X. McKeen, Carlos V. Rozas
-
Publication number: 20150033034Abstract: Embodiments of an invention for measuring a secure enclave are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first, a second, and a third instruction. The execution unit is to execute the first, the second, and the third instruction. Execution of the first instruction includes initializing a measurement field in a control structure of a secure enclave with an initial value. Execution of the second instruction includes adding a region to the secure enclave. Execution of the third instruction includes measuring a subregion of the region.Type: ApplicationFiled: July 23, 2013Publication date: January 29, 2015Inventors: Gideon Gerzon, Shay Gueron, Simon P. Johnson, Francis X. Mckeen, Carlos V. Rozas, Uday R. Savagaonkar, Vincent R. Scarlata, Ittai Anati
-
Publication number: 20140297962Abstract: Instructions and logic provide advanced paging capabilities for secure enclave page caches. Embodiments include multiple hardware threads or processing cores, a cache to store secure data for a shared page address allocated to a secure enclave accessible by the hardware threads. A decode stage decodes a first instruction specifying said shared page address as an operand, and execution units mark an entry corresponding to an enclave page cache mapping for the shared page address to block creation of a new translation for either of said first or second hardware threads to access the shared page. A second instruction is decoded for execution, the second instruction specifying said secure enclave as an operand, and execution units record hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave, and decrement the recorded number of hardware threads when any of the hardware threads exits the secure enclave.Type: ApplicationFiled: March 31, 2013Publication date: October 2, 2014Inventors: CARLOS V ROZAS, ILYA ALEXANDROVICH, ITTAI ANATI, ALEX BERENZON, MICHAEL A GOLDSMITH, BARRY E HUNTLEY, ANTON IVANOV, SIMON P JOHNSON, REBEKAH M. LESLIE-HURD, FRANCIS X. MCKEEN, GILBERT NEIGER, RINAT RAPPOPORT, SCOTT DION RODGERS, UDAY R. SAVAGAONKAR, VINCENT R. SCARLATA, VEDVYAS SHANBHOGUE, WESLEY H SMITH, WILLIAM COLIN WOOD
-
Patent number: 8832452Abstract: An apparatus and method are described for implementing a trusted dynamic launch and trusted platform module (TPM) using a secure enclave. For example, a computer-implemented method according to one embodiment of the invention comprises: initializing a secure enclave in response to a first command, the secure enclave comprising a trusted software execution environment which prevents software executing outside the enclave from having access to software and data inside the enclave; and executing a trusted platform module (TPM) from within the secure enclave, the trusted platform module securely reading data from a set of platform control registers (PCR) in a processor or chipset component into a memory region allocated to the secure enclave.Type: GrantFiled: December 22, 2010Date of Patent: September 9, 2014Assignee: Intel CorporationInventors: Simon P. Johnson, Vincent R. Scarlata, Willard M. Wiseman